diff options
Diffstat (limited to 'sshadvanced.html')
| -rw-r--r-- | sshadvanced.html | 224 |
1 files changed, 0 insertions, 224 deletions
diff --git a/sshadvanced.html b/sshadvanced.html deleted file mode 100644 index e825f45..0000000 --- a/sshadvanced.html +++ /dev/null @@ -1,224 +0,0 @@ -<!DOCTYPE html> -<html lang=en> -<head> - <title>SSH - Advanced Usage – LandChad.net</title> - <meta charset="utf-8" /> - <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" /> - <link rel='stylesheet' type='text/css' href='style.css'> - <meta name="viewport" content="width=device-width, initial-scale=1"> - <link rel='alternate' type='application/rss+xml' title='Land Chad RSS' href='/rss.xml'> -</head> -<body> - <header> - <h1>SSH - Advanced Usage</h1> - </header> - <nav></nav> - <main class="justified-paragraphs"> - <h2>Introduction</h2> - <p> - This page is dedicated to advanced SSH usage examples. We will discuss the following concepts: - <ul> - <li>config files (for client)</li> - <li>tunneling</li> - <li>jumping</li> - </ul> - </p> - <h2>Config files</h2> - <p> - Config files allow you to specify certain rules for all or chosen hosts. The file has a really simple structure. - It is divided into sections which begin with the <code>Host</code> keyword. Sections are read one by one and <b>the first - matching section takes precedence over the remaining sections</b> - you write more specific sections at the top and the more general - sections below. - </p> - <h3>Why even bother?</h3> - <p> - You might say that SSH client doesn't need any special configuration - you just type user@host and that's it. - Well, what happens when you manage multiple servers? Maybe you want to use a different pair of keys for each servers? - Maybe the server uses a port other than the default 22 to avoid automated bots trying to log in? - </p> - <p> - That's where config files come in handy! - </p> - <h3>Example scenario</h3> - <p> - Let's assume that you manage 3 servers, with the following access info: - <ol> - <li>very.long.hostname.example1.com - <ul> - <li>user: admin</li> - <li>port: 22</li> - <li>key name: id_rsa</li> - </ul> - </li> - <li>example2.com - <ul> - <li>user: billthemaster</li> - <li>port: 2222</li> - <li>key name: example2_ecdsa</li> - </ul> - </li> - <li>192.168.133.7 - <ul> - <li>user: management</li> - <li>port: 22</li> - <li>key name: id_rsa</li> - </ul> - </li> - </ol> - </p> - <p> - You got tired having to always specify the identity file location with the <code>-i</code> option and the port with <code>-p</code> option for example2.com. - Don't even mention <code>admin@very.long.hostname.example1.com</code>! - </p> - <p>In the given example, the config file could look like this: -<pre><code>Host server1 - HostName very.long.hostname.example1.com - User admin - IdentityFile ~/.ssh/id_rsa - -Host server2 - HostName example2.com - Port 2222 - User billthemaster - IdentityFile ~/.ssh/example2_ecdsa - -Host server3 - HostName 192.168.133.7 - User management - IdentityFile ~/.ssh/id_rsa - -Host * - IdentityFile /path/to/some/other/key -</code></pre> - </p> - <p>You can see here usage of <code>Host *</code>. Options specified in this section will affect all other hosts.</p> - <h3>But where do I put this file?</h3> - <p> - SSH looks for the options in the following order: - <ol> - <li>command line arguments</li> - <li><code>~/.ssh/config</code></li> - <li><code>/etc/ssh/ssh_config</code></li> - </ol> - </p> - <p>You can also specify a custom path with the <code>-F</code> argument, for example: - <pre><code>ssh -F ~/Documents/projects/someproject/config/ssh production</code></pre> - </p> - <p> - ...or discard any config file: - <pre><code>ssh -F /dev/null username@hostname</code></pre> - </p> - <p>There's more to ssh config files, but I direct you to <code>man ssh_config</code> for more information</p> - <h2>SSH Tunneling ("port forwarding")</h2> - <p> - SSH tunneling gives you the ability to route TCP traffic from your location to the remote server or the other way around (if server allows for this). - Thanks to it, you can set up a secure connection with a service that doesn't provide any encryption by default. You can treat it like a lite VPN. - </p> - <p> - You can for example access your SQL server via SSH without opening the port for public - you just need SSH port opened on the server's firewall. - It's also a great way of creating a secure channel for connecting with other hosts on the server's network. - </p> - <h3>Local to remote</h3> - <p> - You can route traffic from your local network to the remote server's network by using the <code>-L</code> option. - Let's say you want to access a MySQL service on the remote server. You can tell SSH to route any - traffic that comes to your 3000 port to port 3306 on the remote server with the following example: - <pre><code>ssh -L 3000:localhost:3306 username@example.com</code></pre> - </p> - <p> - The above command states that anyone connecting to your port 3000 will be routed via the SSH connection to the localhost:3306 from the remote server's perspective - </p> - <p> - If you can't understand the above description, let's take a look at another example: - <pre><code>ssh -L localhost:8080:192.168.178.25:80 username@example.com</code></pre> - </p> - <p> - The above command states that any traffic coming from your device (and only yours, because of <code>localhost</code>) will be routed via the - SSH channel to <code>192.168.178.25:80</code> in the server's network. - </p> - <p> - In general, the argument's structure is as follows: - <pre><code>-L [local_address:][local_port]:[remote_address]:[remote_port]</code></pre> - </p> - <p> - The <code>local_address</code> can be your LAN IP, <code>localhost</code> or any other address that your device has. Depending on it, other devices in - the specified network will be able to connect to you or not. - </p> - <p> - The <code>remote_address</code> can be any address reachable from the server. - </p> - <p>You can, of course, route multiple ports. For example: - <pre><code>ssh -L 8000:localhost:8000 -L 8001:localhost:8001 username@example.com</code></pre> - </p> - <p> - Please, remember, this works <b>only</b> on TCP based services, <b>not</b> UDP based. - </p> - <h3>Remote to local</h3> - <p> - There might come a need for you to open your locally running service (for example a game server) to external connections. - Let's say you can't or don't want to set up port forwarding on your router. - </p> - <p> - You can use SSH to forward any traffic that is coming to a port on remote server to a port on your local network host. - The same as in the case "Local to remote", but the other way around. - </p> - <p> - However, there is one additional step that is neccessary and requires you to have a root access to the remote server. You have to - edit <code>/etc/ssh/sshd_config</code> file, to instruct SSH server to route traffic to the other end of SSH connection - your device. - <br/> - Find and uncomment or append the one of the following lines to the file: - <pre><code>GatewayPorts yes # to allow all remote devices -GatewayPorts clientspecified # to allow only specific remote devices -</code></pre> - </p> - <p>You can then specify the forwarding rule with the <code>-R</code> option, for example open <code>192.168.178.2:21</code> on your local network, - to be accessible from a remote server on port 2100: - <pre><code>ssh -R 2100:localhost:21 username@example.com</code></pre> - </p> - <p>...or provide access only to your friend with an IP <code>111.111.111.111</code>: - <pre><code>ssh -R 111.111.111.111:2100:localhost:21 username@example.com</code></pre></p> - <p> - You can replace <code>localhost</code> with any host accessible from your local device, for example your local media server etc. - </p> - <h2>SSH Jumping</h2> - <p> - Jumping is a method of connecting to a target via one or more intermediate servers. This can be used to access servers behind firewalls etc. - All connections on the chain are encrypted and routed via SSH. - </p> - <p> - You can easily jump as shown in the following example: - <pre><code>ssh -J username1@example1.com username2@example2.com</code></pre> - </p> - <p>You can also specify multiple intermediaries, by separating them with a comma: - <pre><code>ssh -J username1@example2.com,username2@example.com username3@example3.com</code></pre> - </p> - <p>There is also a possibility to set up "jumping" connection in a config file: -<pre><code>Host intermediary1 - HostName target.intermediary-example.com - User john - -Host target1 - HostName target.example.com - ProxyJump intermediary1 - -Host target2 - HostName target2.example.com - ProxyJump username@example1.com -</code></pre> - </p> - </main> - <footer> - <a href="https://landchad.net">LandChad.net</a> - </br>Because Everyone should be an Internet LandChad.</br> - <a href="index.html"> - <li><img src="pix/chad.gif" alt="chad"></li></a> - <a href="rss.xml"> - <li><img src="pix/rss.svg" alt="RSS"></li></a> - <a href="pix/btc.png"> - <li><img src="pix/btc.svg" alt="BTC"></li></a> - <a href="pix/xmr.png"> - <li><img src="pix/xmr.svg" alt="XMR"></li></a> - <a href="https://github.com/lukesmithxyz/landchad"> - <li><img src="pix/git.svg" alt="Github"></li></a> - </footer> -</body>
\ No newline at end of file |